CVE-2026-17137 PUBLISHED

Multiple Vulnerabilities in IBM API Connect

Assigner: ibm
Reserved: 24.07.2026 Published: 07.11.2026 Updated: 07.11.2026

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to improper use of cryptography. The encryption applied to stored data is not implemented with sufficient strength, which weakens its protection.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 4

Product Status

Vendor IBM
Product API Connect
Versions
  • affected from 12.1.0.0 to 12.1.1.2 (incl.)

Solutions

IBM strongly recommends addressing the vulnerability now by upgrading to v12.1.1.3 Fix Central Link: https://www.ibm.com/support/pages/node/7290205

References

Problem Types

  • CWE-329 Generation of Predictable IV with CBC Mode CWE